GoogleContainerTools/skaffold · error

getting image: %w

Error message

getting image: %w

What it means

AddRemoteTag fails with "getting image: %w" when getRemoteImage cannot pull the source image from the remote registry. getRemoteImage parses the reference, applies auth from the default keychain, optionally selects a platform, and calls go-containerregistry's remote.Image. Any registry connectivity, auth, or missing-image failure surfaces wrapped here.

Source

Thrown at pkg/skaffold/docker/remote.go:65

	if err != nil {
		return err
	}

	if len(platforms) > 1 {
		index, err := getRemoteIndex(src, cfg)
		if err != nil {
			return fmt.Errorf("getting image index: %w", err)
		}
		return remote.WriteIndex(targetRef, index, remote.WithAuthFromKeychain(primaryKeychain))
	}

	var pl v1.Platform
	if len(platforms) == 1 {
		pl = util.ConvertToV1Platform(platforms[0])
	}
	img, err := getRemoteImage(src, cfg, pl)
	if err != nil {
		return fmt.Errorf("getting image: %w", err)
	}

	return remote.Write(targetRef, img, remote.WithAuthFromKeychain(primaryKeychain))
}

func getRemoteDigest(identifier string, cfg Config, platforms []specs.Platform) (string, error) {
	idx, err := getRemoteIndex(identifier, cfg)
	if err == nil {
		return digest(idx)
	}
	if len(platforms) > 1 {
		return "", fmt.Errorf("cannot fetch remote index for multiple platform image %q: %w", identifier, err)
	}
	var pl v1.Platform
	if len(platforms) == 1 {
		pl = util.ConvertToV1Platform(platforms[0])
	}
	img, err := getRemoteImage(identifier, cfg, pl)

View on GitHub (pinned to a1189de023)

Solutions

1. Verify the src image exists: run `docker manifest inspect <src>` or `crane digest <src>` with the same tag/digest.
2. Refresh registry credentials (docker login <registry>) and ensure the credential helper/keychain Skaffold uses has access.
3. If the registry is HTTP-only or self-signed, add it to insecure_registries in Skaffold config so parseReference/insecureTransportOption apply.
4. Check network/proxy connectivity to the registry host (DNS, firewall, corporate proxy).
5. If a specific platform was requested, confirm the image publishes a manifest for that os/arch.

Example fix

// before
docker.AddRemoteTag("gcr.io/proj/app:v1.0.0", target, cfg, nil)
// after — verify reference and auth first
if _, err := crane.Digest("gcr.io/proj/app:v1.0.0"); err != nil { log.Fatalf("source image not reachable: %v", err) }
docker.AddRemoteTag("gcr.io/proj/app:v1.0.0", target, cfg, nil)

func imageReachable(ref string) error {
	_, err := crane.Digest(ref)
	return err
}
// call before AddRemoteTag: if err := imageReachable(src); err != nil { return fmt.Errorf("source image not reachable: %w", err) }

func isValidImageRef(s string) bool {
	_, err := name.ParseReference(s, name.WeakValidation)
	return err == nil && s != ""
}

if err := docker.AddRemoteTag(src, target, cfg, platforms); err != nil {
	if strings.Contains(err.Error(), "getting image") {
		var te *transport.Error
		if errors.As(err, &te) && te.StatusCode == http.StatusNotFound {
			return fmt.Errorf("image %s not found in registry; check tag/digest", src)
		}
	}
	return err
}

When it happens

Trigger: AddRemoteTag called with 0 or 1 platforms while the source image reference is wrong, the image does not exist in the registry, credentials are missing/expired, or the registry is unreachable (only the multi-platform path uses getRemoteIndex instead).

Common situations: Typo'd image name or tag passed as src; image was garbage-collected from the registry; docker/config.json has stale push tokens for a private registry; private registry not listed in insecure_registries so TLS fails.

Related errors

• %s %q: %w
• INIT_DOCKER_NETWORK_CONTAINER_DOES_NOT_EXIST
• creating skaffold network %s: %w
• getting auth config: %w
• unable to stream build output: %w

AI-assisted analysis of GoogleContainerTools/skaffold@a1189de023 (2026-09-05). Data as JSON: /api/errors/4bb585febefa321e. Report an issue: GitHub.